Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\systemresetplatform.url
- %HOMEPATH%\cellularapi\systemresetplatform.vbs
- %HOMEPATH%\cellularapi\auditcse.com
- 'so#####min.linkpc.net':80
- DNS ASK so#####min.linkpc.net
- '%WINDIR%\syswow64\cmd.exe' /C WScript "%PROGRAMDATA%\EiNJhfkBGQ\r.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\EiNJhfkBGQ\r.vbs"
- '%WINDIR%\notepad.exe' -c "%PROGRAMDATA%\EiNJhfkBGQ\cfg"